Issue description

I'm trying to send mail by using php's mail function, executed by php-fpm, sendmail provided by postfix. I get an Assertion !(st.st_mode & S_ISGID) || (st.st_gid == getegid())' failed.` error. This does not happen when I use sendmail from the command line.

Might be related to the way php-fpm is spawning unpriviledged child processes from its root master process? UPDATE: It does so by using the setuid() and setgid() syscalls after the child process is forked.

It seems this is the assertion from https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/wrappers/wrapper.c#L204 , but I don't understand what this assertion actually checks for. I'm at a dead end here and don't know how to track this down further.

@ixmatus, you seem to be the author of the file, maybe you can tell me something about why those assertions are there and what case they catch? 😄

exact journald entry:

php-fpm[16885]: [WARNING] [pool piwik] child 16887 said into stderr: "sendmail: /nix/store/3xsjm8rfpy0ysfjs1pcybj33fsigszgp-wrapper.c:204: main: Assertion `!(st.st_mode & S_ISGID) || (st.st_gid == getegid())' failed."

Steps to reproduce

Minimal php script, add a php script like this to a webroot and let it execute by php-fpm:

<?php
    $receiver = "mail@example.com";
    $subject = "Test";
    $text = "Works!";
    if(mail($receiver, $subject, $text)) {
        echo 'Mail sent!';
    } else {
        echo 'Error. :(';
    }
?>

Technical details

• System: 17.09.git.258b4c1 (Hummingbird)
• Nix version: nix-env (Nix) 1.12pre5413_b4b1f452
• Nixpkgs version: 17.03.1051.090ffd5fab
• Sandboxing enabled: false